search

italia / spid-sp-shibboleth

Middleware SPID basato su Shibboleth
Creative Commons Zero v1.0 Universal
13 stars 5 forks source link

Define checkAddress and explicit consistentAddress #34

Closed robertogallea closed 3 years ago

robertogallea commented 3 years ago

CIE populates <saml2:SubjectLocality /> and <saml2:SubjectConfirmationData /> using an IP different from the client that made the request. Using checkAddress="false" solves the problem. However, to prevent cookie theft is suggested to use also consistentAddress="true". This setting is true by default, but perhaps it is a good idea to make it explicit.

robertogallea commented 3 years ago

The combination checkAddress(false) + consistentAddress(true) is the suggested option to prevent false positives (i.e. legitimate accesses blocked by checkAddress).

Also, please note that this PR just make consistentAddress explicit without actually changing anything in the configuration.